
<!doctype html>
<html lang="en" class="no-js">
  <head>
    
      <meta charset="utf-8">
      <meta name="viewport" content="width=device-width,initial-scale=1">
      
      
      
      <link rel="icon" href="../../../../static/images/favicon.png">
      <meta name="generator" content="mkdocs-1.3.0, mkdocs-material-8.2.8">
    
    
      
        <title>基于 nexus3+minio/s3 搭建 docker/helm 镜像仓库 - WL4G DOCS</title>
      
    
    
      <link rel="stylesheet" href="../../../../assets/stylesheets/main.644de097.min.css">
      
        
        <link rel="stylesheet" href="../../../../assets/stylesheets/palette.e6a45f82.min.css">
        
      
    
    
    
      
        
        
        <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
        <link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback">
        <style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style>
      
    
    
      <link rel="stylesheet" href="../../../../static/css/util.css">
    
    <script>__md_scope=new URL("../../../..",location),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script>
    
      

    
    
  </head>
  
  
    
    
      
    
    
    
    
    <body dir="ltr" data-md-color-scheme="default" data-md-color-primary="" data-md-color-accent="">
  
    
    
      <script>var palette=__md_get("__palette");if(palette&&"object"==typeof palette.color)for(var key of Object.keys(palette.color))document.body.setAttribute("data-md-color-"+key,palette.color[key])</script>
    
    <input class="md-toggle" data-md-toggle="drawer" type="checkbox" id="__drawer" autocomplete="off">
    <input class="md-toggle" data-md-toggle="search" type="checkbox" id="__search" autocomplete="off">
    <label class="md-overlay" for="__drawer"></label>
    <div data-md-component="skip">
      
        
        <a href="#nexus3minios3-dockerhelm" class="md-skip">
          Skip to content
        </a>
      
    </div>
    <div data-md-component="announce">
      
    </div>
    
      <div data-md-component="outdated" hidden>
        <aside class="md-banner md-banner--warning">
          
        </aside>
      </div>
    
    
      

<header class="md-header" data-md-component="header">
  <nav class="md-header__inner md-grid" aria-label="Header">
    <a href="../../../.." title="WL4G DOCS" class="md-header__button md-logo" aria-label="WL4G DOCS" data-md-component="logo">
      
  <img src="../../../../static/images/mylogo.jpeg" alt="logo">

    </a>
    <label class="md-header__button md-icon" for="__drawer">
      <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M3 6h18v2H3V6m0 5h18v2H3v-2m0 5h18v2H3v-2z"/></svg>
    </label>
    <div class="md-header__title" data-md-component="header-title">
      <div class="md-header__ellipsis">
        <div class="md-header__topic">
          <span class="md-ellipsis">
            WL4G DOCS
          </span>
        </div>
        <div class="md-header__topic" data-md-component="header-topic">
          <span class="md-ellipsis">
            
              基于 nexus3+minio/s3 搭建 docker/helm 镜像仓库
            
          </span>
        </div>
      </div>
    </div>
    
      <form class="md-header__option" data-md-component="palette">
        
          
          
          <input class="md-option" data-md-color-media="(prefers-color-scheme: light)" data-md-color-scheme="default" data-md-color-primary="" data-md-color-accent=""  aria-label="Switch to dark mode"  type="radio" name="__palette" id="__palette_1">
          
            <label class="md-header__button md-icon" title="Switch to dark mode" for="__palette_2" hidden>
              <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6zm0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4zM7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3z"/></svg>
            </label>
          
        
          
          
          <input class="md-option" data-md-color-media="(prefers-color-scheme: dark)" data-md-color-scheme="slate" data-md-color-primary="" data-md-color-accent=""  aria-label="Switch to light mode"  type="radio" name="__palette" id="__palette_2">
          
            <label class="md-header__button md-icon" title="Switch to light mode" for="__palette_1" hidden>
              <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3z"/></svg>
            </label>
          
        
      </form>
    
    
      <div class="md-header__option">
        <div class="md-select">
          
          <button class="md-header__button md-icon" aria-label="Select language">
            <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="m12.87 15.07-2.54-2.51.03-.03A17.52 17.52 0 0 0 14.07 6H17V4h-7V2H8v2H1v2h11.17C11.5 7.92 10.44 9.75 9 11.35 8.07 10.32 7.3 9.19 6.69 8h-2c.73 1.63 1.73 3.17 2.98 4.56l-5.09 5.02L4 19l5-5 3.11 3.11.76-2.04M18.5 10h-2L12 22h2l1.12-3h4.75L21 22h2l-4.5-12m-2.62 7 1.62-4.33L19.12 17h-3.24z"/></svg>
          </button>
          <div class="md-select__inner">
            <ul class="md-select__list">
              
                <li class="md-select__item">
                  <a href="/en/" hreflang="en" class="md-select__link">
                    English
                  </a>
                </li>
                
                <li class="md-select__item">
                  <a href="/zh/" hreflang="zh" class="md-select__link">
                    简体中文
                  </a>
                </li>
                
            </ul>
          </div>
        </div>
      </div>
    
    
      <label class="md-header__button md-icon" for="__search">
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.516 6.516 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5z"/></svg>
      </label>
      <div class="md-search" data-md-component="search" role="dialog">
  <label class="md-search__overlay" for="__search"></label>
  <div class="md-search__inner" role="search">
    <form class="md-search__form" name="search">
      <input type="text" class="md-search__input" name="query" aria-label="Search" placeholder="Search" autocapitalize="off" autocorrect="off" autocomplete="off" spellcheck="false" data-md-component="search-query" required>
      <label class="md-search__icon md-icon" for="__search">
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.516 6.516 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5z"/></svg>
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11h12z"/></svg>
      </label>
      <nav class="md-search__options" aria-label="Search">
        
        <button type="reset" class="md-search__icon md-icon" aria-label="Clear" tabindex="-1">
          <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12 19 6.41z"/></svg>
        </button>
      </nav>
      
        <div class="md-search__suggest" data-md-component="search-suggest"></div>
      
    </form>
    <div class="md-search__output">
      <div class="md-search__scrollwrap" data-md-scrollfix>
        <div class="md-search-result" data-md-component="search-result">
          <div class="md-search-result__meta">
            Initializing search
          </div>
          <ol class="md-search-result__list"></ol>
        </div>
      </div>
    </div>
  </div>
</div>
    
    
  </nav>
  
</header>
    
    <div class="md-container" data-md-component="container">
      
      
        
          
            
<nav class="md-tabs" aria-label="Tabs" data-md-component="tabs">
  <div class="md-tabs__inner md-grid">
    <ul class="md-tabs__list">
      
        
  
  


  
  
  
    <li class="md-tabs__item">
      <a href="../../../.." class="md-tabs__link">
        Getting Started
      </a>
    </li>
  

      
    </ul>
  </div>
</nav>
          
        
      
      <main class="md-main" data-md-component="main">
        <div class="md-main__inner md-grid">
          
            
              
              <div class="md-sidebar md-sidebar--primary" data-md-component="sidebar" data-md-type="navigation" >
                <div class="md-sidebar__scrollwrap">
                  <div class="md-sidebar__inner">
                    

  


  

<nav class="md-nav md-nav--primary md-nav--lifted md-nav--integrated" aria-label="Navigation" data-md-level="0">
  <label class="md-nav__title" for="__drawer">
    <a href="../../../.." title="WL4G DOCS" class="md-nav__button md-logo" aria-label="WL4G DOCS" data-md-component="logo">
      
  <img src="../../../../static/images/mylogo.jpeg" alt="logo">

    </a>
    WL4G DOCS
  </label>
  
  <ul class="md-nav__list" data-md-scrollfix>
    
      
      
      

  
  
  
    
    <li class="md-nav__item md-nav__item--nested">
      
      
        <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_1" data-md-state="indeterminate" type="checkbox" id="__nav_1" checked>
      
      
      
      
        <label class="md-nav__link" for="__nav_1">
          Getting Started
          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" aria-label="Getting Started" data-md-level="1">
        <label class="md-nav__title" for="__nav_1">
          <span class="md-nav__icon md-icon"></span>
          Getting Started
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
              
  
  
  
    <li class="md-nav__item">
      <a href="../../../.." class="md-nav__link">
        Introduction
      </a>
    </li>
  

            
          
            
              
  
  
  
    <li class="md-nav__item">
      <a href="../../../../ABOUT_CN/" class="md-nav__link">
        About
      </a>
    </li>
  

            
          
        </ul>
      </nav>
    </li>
  

    
  </ul>
</nav>
                  </div>
                </div>
              </div>
            
            
          
          <div class="md-content" data-md-component="content">
            <article class="md-content__inner md-typeset">
              
                


<h1 id="nexus3minios3-dockerhelm">基于 nexus3+minio/s3 搭建 docker/helm 镜像仓库<a class="headerlink" href="#nexus3minios3-dockerhelm" title="Permanent link">&para;</a></h1>
<ul>
<li>相关文章：<a href="https://blogs.wl4g.com:443/archives/2865">容器化部署之 image mirror 加速方案</a></li>
</ul>
<h2 id="1-docker">1. 基于<code>docker</code>单机部署<a class="headerlink" href="#1-docker" title="Permanent link">&para;</a></h2>
<ul>
<li>此部署方案，仅推荐用于测试环境</li>
</ul>
<div class="highlight"><pre><span></span><code><a id="__codelineno-0-1" name="__codelineno-0-1"></a><a href="#__codelineno-0-1"><span class="linenos" data-linenos=" 1 "></span></a><span class="c1"># 创建宿主机数据目录</span>
<a id="__codelineno-0-2" name="__codelineno-0-2"></a><a href="#__codelineno-0-2"><span class="linenos" data-linenos=" 2 "></span></a>sudo mkdir -p /mnt/disk1/nexus3/data
<a id="__codelineno-0-3" name="__codelineno-0-3"></a><a href="#__codelineno-0-3"><span class="linenos" data-linenos=" 3 "></span></a>sudo chmod <span class="m">777</span> -R /mnt/disk1/nexus3/
<a id="__codelineno-0-4" name="__codelineno-0-4"></a><a href="#__codelineno-0-4"><span class="linenos" data-linenos=" 4 "></span></a>
<a id="__codelineno-0-5" name="__codelineno-0-5"></a><a href="#__codelineno-0-5"><span class="linenos" data-linenos=" 5 "></span></a><span class="c1"># 启动单机 nexus3 容器</span>
<a id="__codelineno-0-6" name="__codelineno-0-6"></a><a href="#__codelineno-0-6"><span class="linenos" data-linenos=" 6 "></span></a>docker run -d <span class="se">\</span>
<a id="__codelineno-0-7" name="__codelineno-0-7"></a><a href="#__codelineno-0-7"><span class="linenos" data-linenos=" 7 "></span></a>--name nexus3 <span class="se">\</span>
<a id="__codelineno-0-8" name="__codelineno-0-8"></a><a href="#__codelineno-0-8"><span class="linenos" data-linenos=" 8 "></span></a>--restart<span class="o">=</span>no <span class="se">\</span>
<a id="__codelineno-0-9" name="__codelineno-0-9"></a><a href="#__codelineno-0-9"><span class="linenos" data-linenos=" 9 "></span></a>--ulimit <span class="nv">nofile</span><span class="o">=</span><span class="m">655350</span> <span class="se">\</span>
<a id="__codelineno-0-10" name="__codelineno-0-10"></a><a href="#__codelineno-0-10"><span class="linenos" data-linenos="10 "></span></a>--ulimit <span class="nv">memlock</span><span class="o">=</span>-1 <span class="se">\</span>
<a id="__codelineno-0-11" name="__codelineno-0-11"></a><a href="#__codelineno-0-11"><span class="linenos" data-linenos="11 "></span></a>--memory<span class="o">=</span>1G <span class="se">\</span>
<a id="__codelineno-0-12" name="__codelineno-0-12"></a><a href="#__codelineno-0-12"><span class="linenos" data-linenos="12 "></span></a>--memory-swap<span class="o">=</span>-1 <span class="se">\</span>
<a id="__codelineno-0-13" name="__codelineno-0-13"></a><a href="#__codelineno-0-13"><span class="linenos" data-linenos="13 "></span></a>--cpuset-cpus<span class="o">=</span><span class="s1">&#39;1-7&#39;</span> <span class="se">\</span>
<a id="__codelineno-0-14" name="__codelineno-0-14"></a><a href="#__codelineno-0-14"><span class="linenos" data-linenos="14 "></span></a>-e <span class="nv">INSTALL4J_ADD_VM_PARAMS</span><span class="o">=</span><span class="s2">&quot;-XX:InitialRAMPercentage=80.0 -XX:MinRAMPercentage=80.0 -XX:MaxRAMPercentage=80.0 -XX:MaxDirectMemorySize=4G&quot;</span> <span class="se">\</span>
<a id="__codelineno-0-15" name="__codelineno-0-15"></a><a href="#__codelineno-0-15"><span class="linenos" data-linenos="15 "></span></a>-p <span class="m">28081</span>:8081 <span class="se">\</span>
<a id="__codelineno-0-16" name="__codelineno-0-16"></a><a href="#__codelineno-0-16"><span class="linenos" data-linenos="16 "></span></a>-p <span class="m">28082</span>:8082 <span class="se">\</span>
<a id="__codelineno-0-17" name="__codelineno-0-17"></a><a href="#__codelineno-0-17"><span class="linenos" data-linenos="17 "></span></a>-p <span class="m">28083</span>:8083 <span class="se">\</span>
<a id="__codelineno-0-18" name="__codelineno-0-18"></a><a href="#__codelineno-0-18"><span class="linenos" data-linenos="18 "></span></a>-v /etc/localtime:/etc/localtime <span class="se">\</span>
<a id="__codelineno-0-19" name="__codelineno-0-19"></a><a href="#__codelineno-0-19"><span class="linenos" data-linenos="19 "></span></a>-v /mnt/disk1/nexus3/data/:/nexus-data/ <span class="se">\</span>
<a id="__codelineno-0-20" name="__codelineno-0-20"></a><a href="#__codelineno-0-20"><span class="linenos" data-linenos="20 "></span></a>sonatype/nexus3:3.37.3
</code></pre></div>
<ul>
<li>
<p>以上参数中，映射的端口<code>28081:8081</code>用于 nexus3 管理控制台，<code>28082:8082</code>、<code>28083:8083</code> 分别用于创建 <code>hosted</code>、<code>group</code> 2种类型的 docker 镜像仓库，其中参数<code>--cpuset-cpus</code>为绑核设置(从0号核开始)请按实际设置，否则可能报错: <code>Requested CPUs are not available - requested 1-7, available: 0-1.</code>。</p>
</li>
<li>
<p><strong><em>注：</em></strong> 以上并没有映射 docker(proxy) 类型的仓库，是因为这种仓库一般会建多个如：docker-proxy-gcr.io / docker-proxy-k8s.gcr.io，同时会配置到 docker(group) 中统一管理了，因此无需映射端口对外提供服务，只需容器内部能访问即可（实际上本文部署的单点 nexus3 就是同一 JVM 进程当然没问题了），另外 nexus3 免费版的 docker group 仅支持 pull 不支持 push。</p>
</li>
<li>
<p>其中<code>INSTALL4J_ADD_VM_PARAMS</code>是针对 nexus3 容器默认 jvm 参数做了优化。<a href="https://blogs.wl4g.com/archives/2969">原因参考: https://blogs.wl4g.com/archives/2969</a></p>
</li>
<li>
<p>查看所有日志: <code>tail -f /mnt/disk1/nexus3/data/log/*</code></p>
</li>
<li>
<p>如需修改日志配置</p>
</li>
</ul>
<div class="highlight"><pre><span></span><code><a id="__codelineno-1-1" name="__codelineno-1-1"></a><a href="#__codelineno-1-1"><span class="linenos" data-linenos="1 "></span></a><span class="c1">## 先以root进入容器</span>
<a id="__codelineno-1-2" name="__codelineno-1-2"></a><a href="#__codelineno-1-2"><span class="linenos" data-linenos="2 "></span></a>docker <span class="nb">exec</span> -u root -it nexus3 bash
<a id="__codelineno-1-3" name="__codelineno-1-3"></a><a href="#__codelineno-1-3"><span class="linenos" data-linenos="3 "></span></a>
<a id="__codelineno-1-4" name="__codelineno-1-4"></a><a href="#__codelineno-1-4"><span class="linenos" data-linenos="4 "></span></a><span class="c1">## 编辑默认日志配置</span>
<a id="__codelineno-1-5" name="__codelineno-1-5"></a><a href="#__codelineno-1-5"><span class="linenos" data-linenos="5 "></span></a>vi opt/sonatype/nexus/etc/logback/logback.xml
</code></pre></div>
<h2 id="2">2. 网关配置<a class="headerlink" href="#2" title="Permanent link">&para;</a></h2>
<ul>
<li>伪域名配置</li>
</ul>
<div class="highlight"><pre><span></span><code><a id="__codelineno-2-1" name="__codelineno-2-1"></a><a href="#__codelineno-2-1"><span class="linenos" data-linenos="1 "></span></a>cat <span class="s">&lt;&lt;-&#39;EOF&#39; &gt;&gt; /etc/hosts</span>
<a id="__codelineno-2-2" name="__codelineno-2-2"></a><a href="#__codelineno-2-2"><span class="linenos" data-linenos="2 "></span></a><span class="s">127.0.0.1 registry.your-domain.io mirror.registry.your-domain.io</span>
<a id="__codelineno-2-3" name="__codelineno-2-3"></a><a href="#__codelineno-2-3"><span class="linenos" data-linenos="3 "></span></a><span class="s">EOF</span>
</code></pre></div>
<ul>
<li>Nginx 配置 <code>/etc/nginx/conf.d/nexus3.conf</code></li>
</ul>
<div class="highlight"><pre><span></span><code><a id="__codelineno-3-1" name="__codelineno-3-1"></a><a href="#__codelineno-3-1"><span class="linenos" data-linenos=" 1 "></span></a>sudo mkdir -p /etc/nginx/conf.d/
<a id="__codelineno-3-2" name="__codelineno-3-2"></a><a href="#__codelineno-3-2"><span class="linenos" data-linenos=" 2 "></span></a>sudo cat <span class="s">&lt;&lt;-&#39;EOF&#39; &gt; /etc/nginx/conf.d/nexus3.conf</span>
<a id="__codelineno-3-3" name="__codelineno-3-3"></a><a href="#__codelineno-3-3"><span class="linenos" data-linenos=" 3 "></span></a><span class="s">##</span>
<a id="__codelineno-3-4" name="__codelineno-3-4"></a><a href="#__codelineno-3-4"><span class="linenos" data-linenos=" 4 "></span></a><span class="s">## Nexus3 OSS gateway configuration.</span>
<a id="__codelineno-3-5" name="__codelineno-3-5"></a><a href="#__codelineno-3-5"><span class="linenos" data-linenos=" 5 "></span></a><span class="s">##</span>
<a id="__codelineno-3-6" name="__codelineno-3-6"></a><a href="#__codelineno-3-6"><span class="linenos" data-linenos=" 6 "></span></a>
<a id="__codelineno-3-7" name="__codelineno-3-7"></a><a href="#__codelineno-3-7"><span class="linenos" data-linenos=" 7 "></span></a><span class="s">## Web console.</span>
<a id="__codelineno-3-8" name="__codelineno-3-8"></a><a href="#__codelineno-3-8"><span class="linenos" data-linenos=" 8 "></span></a><span class="s">server {</span>
<a id="__codelineno-3-9" name="__codelineno-3-9"></a><a href="#__codelineno-3-9"><span class="linenos" data-linenos=" 9 "></span></a><span class="s">   #listen       443;</span>
<a id="__codelineno-3-10" name="__codelineno-3-10"></a><a href="#__codelineno-3-10"><span class="linenos" data-linenos="10 "></span></a><span class="s">   #server_name  registry.your-domain.io;</span>
<a id="__codelineno-3-11" name="__codelineno-3-11"></a><a href="#__codelineno-3-11"><span class="linenos" data-linenos="11 "></span></a><span class="s">   #ssl on;</span>
<a id="__codelineno-3-12" name="__codelineno-3-12"></a><a href="#__codelineno-3-12"><span class="linenos" data-linenos="12 "></span></a><span class="s">   #ssl_certificate cert.d/registry.your-domain.io.pem;</span>
<a id="__codelineno-3-13" name="__codelineno-3-13"></a><a href="#__codelineno-3-13"><span class="linenos" data-linenos="13 "></span></a><span class="s">   #ssl_certificate_key cert.d/registry.your-domain.io.key;</span>
<a id="__codelineno-3-14" name="__codelineno-3-14"></a><a href="#__codelineno-3-14"><span class="linenos" data-linenos="14 "></span></a><span class="s">   #ssl_session_timeout 5m;</span>
<a id="__codelineno-3-15" name="__codelineno-3-15"></a><a href="#__codelineno-3-15"><span class="linenos" data-linenos="15 "></span></a><span class="s">   #ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;</span>
<a id="__codelineno-3-16" name="__codelineno-3-16"></a><a href="#__codelineno-3-16"><span class="linenos" data-linenos="16 "></span></a><span class="s">   #ssl_protocols TLSv1 TLSv1.1 TLSv1.2;</span>
<a id="__codelineno-3-17" name="__codelineno-3-17"></a><a href="#__codelineno-3-17"><span class="linenos" data-linenos="17 "></span></a><span class="s">   #ssl_prefer_server_ciphers on;</span>
<a id="__codelineno-3-18" name="__codelineno-3-18"></a><a href="#__codelineno-3-18"><span class="linenos" data-linenos="18 "></span></a><span class="s">   listen       80;</span>
<a id="__codelineno-3-19" name="__codelineno-3-19"></a><a href="#__codelineno-3-19"><span class="linenos" data-linenos="19 "></span></a><span class="s">   server_name  registry.your-domain.io;</span>
<a id="__codelineno-3-20" name="__codelineno-3-20"></a><a href="#__codelineno-3-20"><span class="linenos" data-linenos="20 "></span></a><span class="s">   proxy_set_header Host $host:$server_port;</span>
<a id="__codelineno-3-21" name="__codelineno-3-21"></a><a href="#__codelineno-3-21"><span class="linenos" data-linenos="21 "></span></a><span class="s">   proxy_set_header X-Real-IP $remote_addr;</span>
<a id="__codelineno-3-22" name="__codelineno-3-22"></a><a href="#__codelineno-3-22"><span class="linenos" data-linenos="22 "></span></a><span class="s">   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;</span>
<a id="__codelineno-3-23" name="__codelineno-3-23"></a><a href="#__codelineno-3-23"><span class="linenos" data-linenos="23 "></span></a><span class="s">   proxy_set_header X-Forwarded-Proto $scheme;</span>
<a id="__codelineno-3-24" name="__codelineno-3-24"></a><a href="#__codelineno-3-24"><span class="linenos" data-linenos="24 "></span></a><span class="s">   proxy_set_header Upgrade $http_upgrade;</span>
<a id="__codelineno-3-25" name="__codelineno-3-25"></a><a href="#__codelineno-3-25"><span class="linenos" data-linenos="25 "></span></a><span class="s">   proxy_set_header Connection &quot;Upgrade&quot;;</span>
<a id="__codelineno-3-26" name="__codelineno-3-26"></a><a href="#__codelineno-3-26"><span class="linenos" data-linenos="26 "></span></a><span class="s">   proxy_connect_timeout 3600;</span>
<a id="__codelineno-3-27" name="__codelineno-3-27"></a><a href="#__codelineno-3-27"><span class="linenos" data-linenos="27 "></span></a><span class="s">   proxy_send_timeout 3600;</span>
<a id="__codelineno-3-28" name="__codelineno-3-28"></a><a href="#__codelineno-3-28"><span class="linenos" data-linenos="28 "></span></a><span class="s">   proxy_read_timeout 3600;</span>
<a id="__codelineno-3-29" name="__codelineno-3-29"></a><a href="#__codelineno-3-29"><span class="linenos" data-linenos="29 "></span></a><span class="s">   proxy_buffering off;</span>
<a id="__codelineno-3-30" name="__codelineno-3-30"></a><a href="#__codelineno-3-30"><span class="linenos" data-linenos="30 "></span></a><span class="s">   proxy_request_buffering off;</span>
<a id="__codelineno-3-31" name="__codelineno-3-31"></a><a href="#__codelineno-3-31"><span class="linenos" data-linenos="31 "></span></a><span class="s">   client_max_body_size 4096m;</span>
<a id="__codelineno-3-32" name="__codelineno-3-32"></a><a href="#__codelineno-3-32"><span class="linenos" data-linenos="32 "></span></a><span class="s">   location / {</span>
<a id="__codelineno-3-33" name="__codelineno-3-33"></a><a href="#__codelineno-3-33"><span class="linenos" data-linenos="33 "></span></a><span class="s">     proxy_pass http://localhost:28081;</span>
<a id="__codelineno-3-34" name="__codelineno-3-34"></a><a href="#__codelineno-3-34"><span class="linenos" data-linenos="34 "></span></a><span class="s">   }</span>
<a id="__codelineno-3-35" name="__codelineno-3-35"></a><a href="#__codelineno-3-35"><span class="linenos" data-linenos="35 "></span></a><span class="s">}</span>
<a id="__codelineno-3-36" name="__codelineno-3-36"></a><a href="#__codelineno-3-36"><span class="linenos" data-linenos="36 "></span></a>
<a id="__codelineno-3-37" name="__codelineno-3-37"></a><a href="#__codelineno-3-37"><span class="linenos" data-linenos="37 "></span></a><span class="s">## Docker release registry(hosted).</span>
<a id="__codelineno-3-38" name="__codelineno-3-38"></a><a href="#__codelineno-3-38"><span class="linenos" data-linenos="38 "></span></a><span class="s">server {</span>
<a id="__codelineno-3-39" name="__codelineno-3-39"></a><a href="#__codelineno-3-39"><span class="linenos" data-linenos="39 "></span></a><span class="s">   #listen       443;</span>
<a id="__codelineno-3-40" name="__codelineno-3-40"></a><a href="#__codelineno-3-40"><span class="linenos" data-linenos="40 "></span></a><span class="s">   #server_name  cr.registry.your-domain.io;</span>
<a id="__codelineno-3-41" name="__codelineno-3-41"></a><a href="#__codelineno-3-41"><span class="linenos" data-linenos="41 "></span></a><span class="s">   #ssl on;</span>
<a id="__codelineno-3-42" name="__codelineno-3-42"></a><a href="#__codelineno-3-42"><span class="linenos" data-linenos="42 "></span></a><span class="s">   #ssl_certificate cert.d/cr.registry.your-domain.io.pem;</span>
<a id="__codelineno-3-43" name="__codelineno-3-43"></a><a href="#__codelineno-3-43"><span class="linenos" data-linenos="43 "></span></a><span class="s">   #ssl_certificate_key cert.d/cr.registry.your-domain.io.key;</span>
<a id="__codelineno-3-44" name="__codelineno-3-44"></a><a href="#__codelineno-3-44"><span class="linenos" data-linenos="44 "></span></a><span class="s">   #ssl_session_timeout 5m;</span>
<a id="__codelineno-3-45" name="__codelineno-3-45"></a><a href="#__codelineno-3-45"><span class="linenos" data-linenos="45 "></span></a><span class="s">   #ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;</span>
<a id="__codelineno-3-46" name="__codelineno-3-46"></a><a href="#__codelineno-3-46"><span class="linenos" data-linenos="46 "></span></a><span class="s">   #ssl_protocols TLSv1 TLSv1.1 TLSv1.2;</span>
<a id="__codelineno-3-47" name="__codelineno-3-47"></a><a href="#__codelineno-3-47"><span class="linenos" data-linenos="47 "></span></a><span class="s">   #ssl_prefer_server_ciphers on;</span>
<a id="__codelineno-3-48" name="__codelineno-3-48"></a><a href="#__codelineno-3-48"><span class="linenos" data-linenos="48 "></span></a><span class="s">   listen        80;</span>
<a id="__codelineno-3-49" name="__codelineno-3-49"></a><a href="#__codelineno-3-49"><span class="linenos" data-linenos="49 "></span></a><span class="s">   server_name   mirror.registry.your-domain.io;</span>
<a id="__codelineno-3-50" name="__codelineno-3-50"></a><a href="#__codelineno-3-50"><span class="linenos" data-linenos="50 "></span></a><span class="s">   proxy_set_header Host $host:$server_port;</span>
<a id="__codelineno-3-51" name="__codelineno-3-51"></a><a href="#__codelineno-3-51"><span class="linenos" data-linenos="51 "></span></a><span class="s">   proxy_set_header X-Real-IP $remote_addr;</span>
<a id="__codelineno-3-52" name="__codelineno-3-52"></a><a href="#__codelineno-3-52"><span class="linenos" data-linenos="52 "></span></a><span class="s">   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;</span>
<a id="__codelineno-3-53" name="__codelineno-3-53"></a><a href="#__codelineno-3-53"><span class="linenos" data-linenos="53 "></span></a><span class="s">   proxy_set_header X-Forwarded-Proto $scheme;</span>
<a id="__codelineno-3-54" name="__codelineno-3-54"></a><a href="#__codelineno-3-54"><span class="linenos" data-linenos="54 "></span></a><span class="s">   proxy_set_header Upgrade $http_upgrade;</span>
<a id="__codelineno-3-55" name="__codelineno-3-55"></a><a href="#__codelineno-3-55"><span class="linenos" data-linenos="55 "></span></a><span class="s">   proxy_set_header Connection &quot;Upgrade&quot;;</span>
<a id="__codelineno-3-56" name="__codelineno-3-56"></a><a href="#__codelineno-3-56"><span class="linenos" data-linenos="56 "></span></a><span class="s">   proxy_connect_timeout 3600;</span>
<a id="__codelineno-3-57" name="__codelineno-3-57"></a><a href="#__codelineno-3-57"><span class="linenos" data-linenos="57 "></span></a><span class="s">   proxy_send_timeout 3600;</span>
<a id="__codelineno-3-58" name="__codelineno-3-58"></a><a href="#__codelineno-3-58"><span class="linenos" data-linenos="58 "></span></a><span class="s">   proxy_read_timeout 3600;</span>
<a id="__codelineno-3-59" name="__codelineno-3-59"></a><a href="#__codelineno-3-59"><span class="linenos" data-linenos="59 "></span></a><span class="s">   proxy_buffering off;</span>
<a id="__codelineno-3-60" name="__codelineno-3-60"></a><a href="#__codelineno-3-60"><span class="linenos" data-linenos="60 "></span></a><span class="s">   proxy_request_buffering off;</span>
<a id="__codelineno-3-61" name="__codelineno-3-61"></a><a href="#__codelineno-3-61"><span class="linenos" data-linenos="61 "></span></a><span class="s">   client_max_body_size 4096m;</span>
<a id="__codelineno-3-62" name="__codelineno-3-62"></a><a href="#__codelineno-3-62"><span class="linenos" data-linenos="62 "></span></a><span class="s">   location / {</span>
<a id="__codelineno-3-63" name="__codelineno-3-63"></a><a href="#__codelineno-3-63"><span class="linenos" data-linenos="63 "></span></a><span class="s">     proxy_pass http://localhost:28082; # 注：必须与 docker hosted 类型仓库对应，否则会 push 失败，参见本文 FAQ#8.2</span>
<a id="__codelineno-3-64" name="__codelineno-3-64"></a><a href="#__codelineno-3-64"><span class="linenos" data-linenos="64 "></span></a><span class="s">   }</span>
<a id="__codelineno-3-65" name="__codelineno-3-65"></a><a href="#__codelineno-3-65"><span class="linenos" data-linenos="65 "></span></a><span class="s">}</span>
<a id="__codelineno-3-66" name="__codelineno-3-66"></a><a href="#__codelineno-3-66"><span class="linenos" data-linenos="66 "></span></a>
<a id="__codelineno-3-67" name="__codelineno-3-67"></a><a href="#__codelineno-3-67"><span class="linenos" data-linenos="67 "></span></a><span class="s">## Docker mirror registry(group-&gt;proxy).</span>
<a id="__codelineno-3-68" name="__codelineno-3-68"></a><a href="#__codelineno-3-68"><span class="linenos" data-linenos="68 "></span></a><span class="s">server {</span>
<a id="__codelineno-3-69" name="__codelineno-3-69"></a><a href="#__codelineno-3-69"><span class="linenos" data-linenos="69 "></span></a><span class="s">   #listen       443;</span>
<a id="__codelineno-3-70" name="__codelineno-3-70"></a><a href="#__codelineno-3-70"><span class="linenos" data-linenos="70 "></span></a><span class="s">   #server_name  mirror.registry.your-domain.io;</span>
<a id="__codelineno-3-71" name="__codelineno-3-71"></a><a href="#__codelineno-3-71"><span class="linenos" data-linenos="71 "></span></a><span class="s">   #ssl on;</span>
<a id="__codelineno-3-72" name="__codelineno-3-72"></a><a href="#__codelineno-3-72"><span class="linenos" data-linenos="72 "></span></a><span class="s">   #ssl_certificate cert.d/mirror.registry.your-domain.io.pem;</span>
<a id="__codelineno-3-73" name="__codelineno-3-73"></a><a href="#__codelineno-3-73"><span class="linenos" data-linenos="73 "></span></a><span class="s">   #ssl_certificate_key cert.d/mirror.registry.your-domain.io.key;</span>
<a id="__codelineno-3-74" name="__codelineno-3-74"></a><a href="#__codelineno-3-74"><span class="linenos" data-linenos="74 "></span></a><span class="s">   #ssl_session_timeout 5m;</span>
<a id="__codelineno-3-75" name="__codelineno-3-75"></a><a href="#__codelineno-3-75"><span class="linenos" data-linenos="75 "></span></a><span class="s">   #ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;</span>
<a id="__codelineno-3-76" name="__codelineno-3-76"></a><a href="#__codelineno-3-76"><span class="linenos" data-linenos="76 "></span></a><span class="s">   #ssl_protocols TLSv1 TLSv1.1 TLSv1.2;</span>
<a id="__codelineno-3-77" name="__codelineno-3-77"></a><a href="#__codelineno-3-77"><span class="linenos" data-linenos="77 "></span></a><span class="s">   #ssl_prefer_server_ciphers on;</span>
<a id="__codelineno-3-78" name="__codelineno-3-78"></a><a href="#__codelineno-3-78"><span class="linenos" data-linenos="78 "></span></a><span class="s">   listen        80;</span>
<a id="__codelineno-3-79" name="__codelineno-3-79"></a><a href="#__codelineno-3-79"><span class="linenos" data-linenos="79 "></span></a><span class="s">   server_name   mirror.registry.your-domain.io;</span>
<a id="__codelineno-3-80" name="__codelineno-3-80"></a><a href="#__codelineno-3-80"><span class="linenos" data-linenos="80 "></span></a><span class="s">   proxy_set_header Host $host:$server_port;</span>
<a id="__codelineno-3-81" name="__codelineno-3-81"></a><a href="#__codelineno-3-81"><span class="linenos" data-linenos="81 "></span></a><span class="s">   proxy_set_header X-Real-IP $remote_addr;</span>
<a id="__codelineno-3-82" name="__codelineno-3-82"></a><a href="#__codelineno-3-82"><span class="linenos" data-linenos="82 "></span></a><span class="s">   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;</span>
<a id="__codelineno-3-83" name="__codelineno-3-83"></a><a href="#__codelineno-3-83"><span class="linenos" data-linenos="83 "></span></a><span class="s">   proxy_set_header X-Forwarded-Proto $scheme;</span>
<a id="__codelineno-3-84" name="__codelineno-3-84"></a><a href="#__codelineno-3-84"><span class="linenos" data-linenos="84 "></span></a><span class="s">   proxy_set_header Upgrade $http_upgrade;</span>
<a id="__codelineno-3-85" name="__codelineno-3-85"></a><a href="#__codelineno-3-85"><span class="linenos" data-linenos="85 "></span></a><span class="s">   proxy_set_header Connection &quot;Upgrade&quot;;</span>
<a id="__codelineno-3-86" name="__codelineno-3-86"></a><a href="#__codelineno-3-86"><span class="linenos" data-linenos="86 "></span></a><span class="s">   proxy_connect_timeout 3600;</span>
<a id="__codelineno-3-87" name="__codelineno-3-87"></a><a href="#__codelineno-3-87"><span class="linenos" data-linenos="87 "></span></a><span class="s">   proxy_send_timeout 3600;</span>
<a id="__codelineno-3-88" name="__codelineno-3-88"></a><a href="#__codelineno-3-88"><span class="linenos" data-linenos="88 "></span></a><span class="s">   proxy_read_timeout 3600;</span>
<a id="__codelineno-3-89" name="__codelineno-3-89"></a><a href="#__codelineno-3-89"><span class="linenos" data-linenos="89 "></span></a><span class="s">   proxy_buffering off;</span>
<a id="__codelineno-3-90" name="__codelineno-3-90"></a><a href="#__codelineno-3-90"><span class="linenos" data-linenos="90 "></span></a><span class="s">   proxy_request_buffering off;</span>
<a id="__codelineno-3-91" name="__codelineno-3-91"></a><a href="#__codelineno-3-91"><span class="linenos" data-linenos="91 "></span></a><span class="s">   client_max_body_size 4096m;</span>
<a id="__codelineno-3-92" name="__codelineno-3-92"></a><a href="#__codelineno-3-92"><span class="linenos" data-linenos="92 "></span></a><span class="s">   location / {</span>
<a id="__codelineno-3-93" name="__codelineno-3-93"></a><a href="#__codelineno-3-93"><span class="linenos" data-linenos="93 "></span></a><span class="s">     proxy_pass http://localhost:28083; # 注：应该与 docker group 类型仓库对应</span>
<a id="__codelineno-3-94" name="__codelineno-3-94"></a><a href="#__codelineno-3-94"><span class="linenos" data-linenos="94 "></span></a><span class="s">   }</span>
<a id="__codelineno-3-95" name="__codelineno-3-95"></a><a href="#__codelineno-3-95"><span class="linenos" data-linenos="95 "></span></a><span class="s">}</span>
<a id="__codelineno-3-96" name="__codelineno-3-96"></a><a href="#__codelineno-3-96"><span class="linenos" data-linenos="96 "></span></a><span class="s">EOF</span>
<a id="__codelineno-3-97" name="__codelineno-3-97"></a><a href="#__codelineno-3-97"><span class="linenos" data-linenos="97 "></span></a>
<a id="__codelineno-3-98" name="__codelineno-3-98"></a><a href="#__codelineno-3-98"><span class="linenos" data-linenos="98 "></span></a>systemctl restart nginx
</code></pre></div>
<h2 id="3-registry">3. 创建 registry 仓库<a class="headerlink" href="#3-registry" title="Permanent link">&para;</a></h2>
<h3 id="31-blob">3.1 创建 Blob 存储<a class="headerlink" href="#31-blob" title="Permanent link">&para;</a></h3>
<ul>
<li>
<p>浏览器访问: https://registry.your-domain.io, 登录进入以后, 首先创建后端 S3 协议的 Blob 存储, <a href="https://www.cnblogs.com/rongfengliang/p/9094503.html">参考: nexus3 配置 minio/s3 blob存储</a></p>
</li>
<li>
<p>环境准备及要求:</p>
</li>
</ul>
<p>1) 必须 Nexus 版本<code>&gt;=3.12</code>
  2) 拥有一个已注册的 S3 对象存储服务地址，或者基于 <a href="https://min.io/">MinIO</a> 已搭建好.</p>
<ul>
<li>(<strong>可选</strong>) 如果您还没有 S3 存储服务, 可参考如下指引部署一个单机 MinIO 实例</li>
</ul>
<blockquote>
<p>基于 kubernetes 的 MinIO 部署请参考: <a href="https://github.com/minio/operator/blob/master/README.md">https://github.com/minio/operator/blob/master/README.md</a></p>
</blockquote>
<div class="highlight"><pre><span></span><code><a id="__codelineno-4-1" name="__codelineno-4-1"></a><a href="#__codelineno-4-1"><span class="linenos" data-linenos="1 "></span></a>sudo mkdir -p /mnt/disk1/nexus3_minio
<a id="__codelineno-4-2" name="__codelineno-4-2"></a><a href="#__codelineno-4-2"><span class="linenos" data-linenos="2 "></span></a>docker run -d <span class="se">\</span>
<a id="__codelineno-4-3" name="__codelineno-4-3"></a><a href="#__codelineno-4-3"><span class="linenos" data-linenos="3 "></span></a>--name nexus3_minio <span class="se">\</span>
<a id="__codelineno-4-4" name="__codelineno-4-4"></a><a href="#__codelineno-4-4"><span class="linenos" data-linenos="4 "></span></a>--restart no <span class="se">\</span>
<a id="__codelineno-4-5" name="__codelineno-4-5"></a><a href="#__codelineno-4-5"><span class="linenos" data-linenos="5 "></span></a>-p <span class="m">9000</span>:9000 <span class="se">\</span>
<a id="__codelineno-4-6" name="__codelineno-4-6"></a><a href="#__codelineno-4-6"><span class="linenos" data-linenos="6 "></span></a>-p <span class="m">9900</span>:9900 <span class="se">\</span>
<a id="__codelineno-4-7" name="__codelineno-4-7"></a><a href="#__codelineno-4-7"><span class="linenos" data-linenos="7 "></span></a>-v /mnt/disk1/nexus3_minio:/data <span class="se">\</span>
<a id="__codelineno-4-8" name="__codelineno-4-8"></a><a href="#__codelineno-4-8"><span class="linenos" data-linenos="8 "></span></a>minio/minio <span class="se">\</span>
<a id="__codelineno-4-9" name="__codelineno-4-9"></a><a href="#__codelineno-4-9"><span class="linenos" data-linenos="9 "></span></a>server /data --console-address <span class="s2">&quot;:9900&quot;</span>
</code></pre></div>
<ul>
<li>
<p>浏览器访问: http://127.0.0.1:9900/, 默认账号密码: minioadmin/minioadmin</p>
</li>
<li>
<p>在 Nexus3 创建 S3 Blob 存储及 docker registry 仓库的操作截图，为使篇幅简洁请前往以下链接查看: <a href="https://gitee.com/wl4g/blogs/tree/master/articles/kubernetes/nexus3-docker-registry-deploy/resources/shots">gitee.com/wl4g/blogs/tree/master/articles/kubernetes/nexus3-docker-registry-deploy/resources/shots</a></p>
</li>
<li>
<p>主要步骤:</p>
</li>
<li>
<p>a) 在 MinIO 创建 S3 bucket</p>
</li>
<li>b) 在 Nexus3 创建 S3 类型的 Blob 存储；</li>
<li>c) 在Nexus3 依次创建仓库<code>my-docker-release</code>(:8082)、<code>my-docker-group</code>(:8083)、<code>my-docker-proxy-gcr.io</code>(:8084)、<code>my-docker-proxy-k8s.gcr.io</code>(:8085)；</li>
<li>d) 在 Nexus3 创建角色<code>nx-docker-all</code>，为了授权简单，搜索docker关键字，分配所有*号结尾的权限；</li>
<li>e) 在 Nexus3 创建用户<code>wl4g</code>，分配角色 <code>nx-docker-all</code>；</li>
<li>f) <strong>重要</strong> 在 Nexus3 菜单 <code>Security</code> -&gt; <code>Realms</code>，一定要分配 <code>Docker Bearer Tokens Realms</code>，否则 pull/push 镜像时失败；</li>
<li>g) 为 Nexus3 设置 Http代理，需注意的是至少在目前 <code>3.37.3</code> 只能是全局生效，这是也是不太完美的地方，因为通常需求按需为某个 <code>proxy</code>类型的仓库设置代理，对此问题的方案就是给代理服务 privoxy 设置 PAC 列表按需精确代理，可参见: <a href="https://blogs.wl4g.com/archives/121">blogs.wl4g.com/archives/121</a>，同时再结合 containerd 的 mirrors 机制就能达到的效果是 pull 某个域名下的仓库时才走私有仓库，例如：<code>crictl pull --creds wl4g:123456 gcr.io/istio-testing/build-tools</code></li>
</ul>
<h2 id="4">4. 配置容器引擎&amp;验证<a class="headerlink" href="#4" title="Permanent link">&para;</a></h2>
<h3 id="41-docker">4.1 Docker 环境验证<a class="headerlink" href="#41-docker" title="Permanent link">&para;</a></h3>
<ul>
<li>如果您的容器引擎是 Docker, 则添加 mirrors 地址到<code>/etc/docker/daemon.json</code>，如:</li>
</ul>
<div class="highlight"><pre><span></span><code><a id="__codelineno-5-1" name="__codelineno-5-1"></a><a href="#__codelineno-5-1"><span class="linenos" data-linenos="1 "></span></a><span class="p">{</span><span class="w"></span>
<a id="__codelineno-5-2" name="__codelineno-5-2"></a><a href="#__codelineno-5-2"><span class="linenos" data-linenos="2 "></span></a><span class="w">  </span><span class="nt">&quot;registry-mirrors&quot;</span><span class="p">:</span><span class="w"> </span><span class="p">[</span><span class="w"></span>
<a id="__codelineno-5-3" name="__codelineno-5-3"></a><a href="#__codelineno-5-3"><span class="linenos" data-linenos="3 "></span></a><span class="w">    </span><span class="s2">&quot;https://hjbu3ivg.mirror.aliyuncs.com&quot;</span><span class="p">,</span><span class="w"></span>
<a id="__codelineno-5-4" name="__codelineno-5-4"></a><a href="#__codelineno-5-4"><span class="linenos" data-linenos="4 "></span></a><span class="w">    </span><span class="s2">&quot;https://mirror.registry.your-domain.io&quot;</span><span class="w"></span>
<a id="__codelineno-5-5" name="__codelineno-5-5"></a><a href="#__codelineno-5-5"><span class="linenos" data-linenos="5 "></span></a><span class="w">  </span><span class="p">],</span><span class="w"></span>
<a id="__codelineno-5-6" name="__codelineno-5-6"></a><a href="#__codelineno-5-6"><span class="linenos" data-linenos="6 "></span></a><span class="w">  </span><span class="nt">&quot;insecure-registries&quot;</span><span class="p">:</span><span class="w"> </span><span class="p">[</span><span class="w"></span>
<a id="__codelineno-5-7" name="__codelineno-5-7"></a><a href="#__codelineno-5-7"><span class="linenos" data-linenos="7 "></span></a><span class="w">    </span><span class="s2">&quot;http://mirror.registry.your-domain.io&quot;</span><span class="w"></span>
<a id="__codelineno-5-8" name="__codelineno-5-8"></a><a href="#__codelineno-5-8"><span class="linenos" data-linenos="8 "></span></a><span class="w">  </span><span class="p">]</span><span class="w"></span>
<a id="__codelineno-5-9" name="__codelineno-5-9"></a><a href="#__codelineno-5-9"><span class="linenos" data-linenos="9 "></span></a><span class="p">}</span><span class="w"></span>
</code></pre></div>
<p>然后重启 dockerd, <code>sudo systemctl restart docker</code></p>
<ul>
<li>pull 镜像验证</li>
</ul>
<div class="highlight"><pre><span></span><code><a id="__codelineno-6-1" name="__codelineno-6-1"></a><a href="#__codelineno-6-1"><span class="linenos" data-linenos=" 1 "></span></a><span class="c1">## 首先指定从 docker 中央仓库拉</span>
<a id="__codelineno-6-2" name="__codelineno-6-2"></a><a href="#__codelineno-6-2"><span class="linenos" data-linenos=" 2 "></span></a>docker pull docker.io/alpine
<a id="__codelineno-6-3" name="__codelineno-6-3"></a><a href="#__codelineno-6-3"><span class="linenos" data-linenos=" 3 "></span></a>
<a id="__codelineno-6-4" name="__codelineno-6-4"></a><a href="#__codelineno-6-4"><span class="linenos" data-linenos=" 4 "></span></a><span class="c1">## 登录私有仓库</span>
<a id="__codelineno-6-5" name="__codelineno-6-5"></a><a href="#__codelineno-6-5"><span class="linenos" data-linenos=" 5 "></span></a>docker login -u wl4g -p <span class="m">123456</span> mirror.registry.your-domain.io
<a id="__codelineno-6-6" name="__codelineno-6-6"></a><a href="#__codelineno-6-6"><span class="linenos" data-linenos=" 6 "></span></a>
<a id="__codelineno-6-7" name="__codelineno-6-7"></a><a href="#__codelineno-6-7"><span class="linenos" data-linenos=" 7 "></span></a><span class="c1">## 创建 tag</span>
<a id="__codelineno-6-8" name="__codelineno-6-8"></a><a href="#__codelineno-6-8"><span class="linenos" data-linenos=" 8 "></span></a>docker tag docker.io/alpine mirror.registry.your-domain.io/mylibrary/alpine
<a id="__codelineno-6-9" name="__codelineno-6-9"></a><a href="#__codelineno-6-9"><span class="linenos" data-linenos=" 9 "></span></a>
<a id="__codelineno-6-10" name="__codelineno-6-10"></a><a href="#__codelineno-6-10"><span class="linenos" data-linenos="10 "></span></a><span class="c1">## 通过控制台 listen 端口查所有版本</span>
<a id="__codelineno-6-11" name="__codelineno-6-11"></a><a href="#__codelineno-6-11"><span class="linenos" data-linenos="11 "></span></a>curl -v http://registry.your-domain.io/repository/my-docker-release/v2/mylibrary/alpine/tags/list
<a id="__codelineno-6-12" name="__codelineno-6-12"></a><a href="#__codelineno-6-12"><span class="linenos" data-linenos="12 "></span></a>
<a id="__codelineno-6-13" name="__codelineno-6-13"></a><a href="#__codelineno-6-13"><span class="linenos" data-linenos="13 "></span></a><span class="o">{</span><span class="s2">&quot;name&quot;</span>:<span class="s2">&quot;mylibrary/alpine&quot;</span>,<span class="s2">&quot;tags&quot;</span>:<span class="o">[</span><span class="s2">&quot;latest&quot;</span><span class="o">]}</span>
<a id="__codelineno-6-14" name="__codelineno-6-14"></a><a href="#__codelineno-6-14"><span class="linenos" data-linenos="14 "></span></a>
<a id="__codelineno-6-15" name="__codelineno-6-15"></a><a href="#__codelineno-6-15"><span class="linenos" data-linenos="15 "></span></a><span class="c1">## 通过仓库 listen 端口查所有版本</span>
<a id="__codelineno-6-16" name="__codelineno-6-16"></a><a href="#__codelineno-6-16"><span class="linenos" data-linenos="16 "></span></a>curl http://mirror.registry.your-domain.io/v2/mylibrary/alpine/tags/list
<a id="__codelineno-6-17" name="__codelineno-6-17"></a><a href="#__codelineno-6-17"><span class="linenos" data-linenos="17 "></span></a>
<a id="__codelineno-6-18" name="__codelineno-6-18"></a><a href="#__codelineno-6-18"><span class="linenos" data-linenos="18 "></span></a><span class="o">{</span><span class="s2">&quot;name&quot;</span>:<span class="s2">&quot;mylibrary/alpine&quot;</span>,<span class="s2">&quot;tags&quot;</span>:<span class="o">[</span><span class="s2">&quot;latest&quot;</span><span class="o">]}</span>
<a id="__codelineno-6-19" name="__codelineno-6-19"></a><a href="#__codelineno-6-19"><span class="linenos" data-linenos="19 "></span></a>
<a id="__codelineno-6-20" name="__codelineno-6-20"></a><a href="#__codelineno-6-20"><span class="linenos" data-linenos="20 "></span></a><span class="c1">## 更多接口:</span>
<a id="__codelineno-6-21" name="__codelineno-6-21"></a><a href="#__codelineno-6-21"><span class="linenos" data-linenos="21 "></span></a>curl http://mirror.registry.your-domain.io/v2/mylibrary/alpine/manifests/latest
<a id="__codelineno-6-22" name="__codelineno-6-22"></a><a href="#__codelineno-6-22"><span class="linenos" data-linenos="22 "></span></a>curl http://mirror.registry.your-domain.io/v2/_catalog
</code></pre></div>
<ul>
<li>
<p>更多API，请参见官方 Docker registry API 规范</p>
</li>
<li>
<p><a href="https://docs.docker.com/registry/spec/api/#listing-image-tags">https://docs.docker.com/registry/spec/api/#listing-image-tags</a></p>
</li>
<li>
<p><a href="https://docs.docker.com/registry/spec/auth/#docker-registry-v2-authentication">https://docs.docker.com/registry/spec/auth/#docker-registry-v2-authentication</a></p>
</li>
</ul>
<h3 id="42-containerd">4.2 Containerd 环境验证<a class="headerlink" href="#42-containerd" title="Permanent link">&para;</a></h3>
<ul>
<li>如果您的容器引擎是 Containerd, 则添加 mirrors 地址到<code>/etc/containerd/config.toml</code>, 如果没有如下配置, 则需先生成, 如:</li>
</ul>
<div class="highlight"><pre><span></span><code><a id="__codelineno-7-1" name="__codelineno-7-1"></a><a href="#__codelineno-7-1"><span class="linenos" data-linenos="1 "></span></a>sudo mkdir -p /etc/containerd/
<a id="__codelineno-7-2" name="__codelineno-7-2"></a><a href="#__codelineno-7-2"><span class="linenos" data-linenos="2 "></span></a>sudo containerd config default &gt; /etc/containerd/config.toml
</code></pre></div>
<ul>
<li>
<p>找到如下的关键字, 然后添加需要映射的 mirrors 地址.</p>
</li>
<li>
<p>官方文档: https://github.com/containerd/cri/blob/master/docs/registry.md#configure-registry-endpoint</p>
</li>
</ul>
<div class="highlight"><pre><span></span><code><a id="__codelineno-8-1" name="__codelineno-8-1"></a><a href="#__codelineno-8-1"><span class="linenos" data-linenos=" 1 "></span></a><span class="p">...</span><span class="w"></span>
<a id="__codelineno-8-2" name="__codelineno-8-2"></a><a href="#__codelineno-8-2"><span class="linenos" data-linenos=" 2 "></span></a><span class="w">    </span><span class="p">[</span><span class="n">plugins</span><span class="p">.</span><span class="s">&quot;io.containerd.grpc.v1.cri&quot;</span><span class="p">.</span><span class="n">registry</span><span class="p">]</span><span class="w">    </span>
<a id="__codelineno-8-3" name="__codelineno-8-3"></a><a href="#__codelineno-8-3"><span class="linenos" data-linenos=" 3 "></span></a><span class="w">      </span><span class="k">[plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.mirrors]</span><span class="w"></span>
<a id="__codelineno-8-4" name="__codelineno-8-4"></a><a href="#__codelineno-8-4"><span class="linenos" data-linenos=" 4 "></span></a><span class="w">        </span><span class="k">[plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.mirrors.&quot;docker.io&quot;]</span><span class="w"></span>
<a id="__codelineno-8-5" name="__codelineno-8-5"></a><a href="#__codelineno-8-5"><span class="linenos" data-linenos=" 5 "></span></a><span class="w">          </span><span class="n">endpoint</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="p">[</span><span class="s">&quot;https://registry-1.docker.io&quot;</span><span class="p">]</span><span class="w"></span>
<a id="__codelineno-8-6" name="__codelineno-8-6"></a><a href="#__codelineno-8-6"><span class="linenos" data-linenos=" 6 "></span></a><span class="w">        </span><span class="k">[plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.mirrors.&quot;gcr.io&quot;]</span><span class="w"></span>
<a id="__codelineno-8-7" name="__codelineno-8-7"></a><a href="#__codelineno-8-7"><span class="linenos" data-linenos=" 7 "></span></a><span class="w">          </span><span class="n">endpoint</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="p">[</span><span class="s">&quot;https://mirror.registry.your-domain.io&quot;</span><span class="p">]</span><span class="w"></span>
<a id="__codelineno-8-8" name="__codelineno-8-8"></a><a href="#__codelineno-8-8"><span class="linenos" data-linenos=" 8 "></span></a><span class="w">      </span><span class="k">[plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.configs]</span><span class="w"></span>
<a id="__codelineno-8-9" name="__codelineno-8-9"></a><a href="#__codelineno-8-9"><span class="linenos" data-linenos=" 9 "></span></a><span class="w">        </span><span class="k">[plugins.&quot;io.containerd.grpc.v1.cri&quot;.registry.configs.&quot;mirror.registry.your-domain.io&quot;.auth]</span><span class="w"></span>
<a id="__codelineno-8-10" name="__codelineno-8-10"></a><a href="#__codelineno-8-10"><span class="linenos" data-linenos="10 "></span></a><span class="w">          </span><span class="n">auth</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="s">&quot;d2w0ZzoxMjM0NTY=&quot;</span><span class="w"></span>
<a id="__codelineno-8-11" name="__codelineno-8-11"></a><a href="#__codelineno-8-11"><span class="linenos" data-linenos="11 "></span></a><span class="w">          </span><span class="c1">## Priority use username-password.</span><span class="w"></span>
<a id="__codelineno-8-12" name="__codelineno-8-12"></a><a href="#__codelineno-8-12"><span class="linenos" data-linenos="12 "></span></a><span class="w">          </span><span class="c1">## see:https://blogs.wl4g.com/archives/66#4.2</span><span class="w"></span>
<a id="__codelineno-8-13" name="__codelineno-8-13"></a><a href="#__codelineno-8-13"><span class="linenos" data-linenos="13 "></span></a><span class="w">          </span><span class="c1">## see:https://github.com/containerd/cri/blob/master/docs/registry.md#configure-registry-endpoint</span><span class="w"></span>
<a id="__codelineno-8-14" name="__codelineno-8-14"></a><a href="#__codelineno-8-14"><span class="linenos" data-linenos="14 "></span></a><span class="w">          </span><span class="n">username</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="s">&quot;wl4g&quot;</span><span class="w"></span>
<a id="__codelineno-8-15" name="__codelineno-8-15"></a><a href="#__codelineno-8-15"><span class="linenos" data-linenos="15 "></span></a><span class="w">          </span><span class="n">password</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="s">&quot;123456&quot;</span><span class="w"></span>
<a id="__codelineno-8-16" name="__codelineno-8-16"></a><a href="#__codelineno-8-16"><span class="linenos" data-linenos="16 "></span></a><span class="w">          </span><span class="c1">#identitytoken = &quot;&quot;</span><span class="w"></span>
<a id="__codelineno-8-17" name="__codelineno-8-17"></a><a href="#__codelineno-8-17"><span class="linenos" data-linenos="17 "></span></a><span class="p">...</span><span class="w"></span>
</code></pre></div>
<ul>
<li>
<p>以上示例表示, 如当<code>crictl pull gcr.io/istio-testing/build-tools</code>时, 实际会被转发到私有仓<code>mirror.registry.your-domain.io</code> (可从日志看出<code>journalctl -afu containerd</code>), 即会转到 Nexus3 OSS, 最终通过已设置的 HTTPS 代理请求到上游<code>gcr.io</code>中央仓库, 这样客户端用户 pull 时是无感知的简单且方便。</p>
</li>
<li>
<p><strong><em>注：</em></strong> 由 CRI 传递的身份验证配置优先于此配置，仅当 Kubernetes 未通过 CRI 指定身份验证配置时，才会使用此配置中的注册表凭据。参见: <a href="https://github.com/containerd/cri/blob/master/docs/registry.md#configure-registry-credentials">github.com/containerd/cri/blob/master/docs/registry.md#configure-registry-credentials</a></p>
</li>
</ul>
<p>修改此配置后，需要重启containerd服务或直接传递给crictl也是正常的, 如: <code>crictl --auth 'd2w0ZzoxMjM0NTY=' gcr.io/istio-testing/build-tools</code></p>
<ul>
<li>
<p><strong><em> 特别注意：</em></strong> 使用 shell 计算 http-basic 认证的 base64 编码时必须加<code>-n</code>, 否则默认后尾追加换行符导致 registry 认证失败, 正例: <code>echo -n 'wl4g:123456' | base64 -w 0</code></p>
</li>
<li>
<p>可能用到 (<strong>可选</strong>)</p>
</li>
<li>
<p>指定<code>cricrl</code>命令的运行时sock地址
<div class="highlight"><pre><span></span><code><a id="__codelineno-9-1" name="__codelineno-9-1"></a><a href="#__codelineno-9-1"><span class="linenos" data-linenos=" 1 "></span></a>sudo cat <span class="s">&lt;&lt;-&#39;EOF&#39; &gt; /etc/crictl.yaml</span>
<a id="__codelineno-9-2" name="__codelineno-9-2"></a><a href="#__codelineno-9-2"><span class="linenos" data-linenos=" 2 "></span></a><span class="s">## Use docker engine.</span>
<a id="__codelineno-9-3" name="__codelineno-9-3"></a><a href="#__codelineno-9-3"><span class="linenos" data-linenos=" 3 "></span></a><span class="s">#image-endpoint: unix:///var/run/crio/dockershim.sock</span>
<a id="__codelineno-9-4" name="__codelineno-9-4"></a><a href="#__codelineno-9-4"><span class="linenos" data-linenos=" 4 "></span></a><span class="s">## Use containerd engine.</span>
<a id="__codelineno-9-5" name="__codelineno-9-5"></a><a href="#__codelineno-9-5"><span class="linenos" data-linenos=" 5 "></span></a><span class="s">runtime-endpoint: unix:///run/containerd/containerd.sock</span>
<a id="__codelineno-9-6" name="__codelineno-9-6"></a><a href="#__codelineno-9-6"><span class="linenos" data-linenos=" 6 "></span></a><span class="s">image-endpoint: unix:///run/containerd/containerd.sock</span>
<a id="__codelineno-9-7" name="__codelineno-9-7"></a><a href="#__codelineno-9-7"><span class="linenos" data-linenos=" 7 "></span></a><span class="s">## Use cri-o engine.</span>
<a id="__codelineno-9-8" name="__codelineno-9-8"></a><a href="#__codelineno-9-8"><span class="linenos" data-linenos=" 8 "></span></a><span class="s">#runtime-endpoint: unix:///var/run/crio/crio.sock</span>
<a id="__codelineno-9-9" name="__codelineno-9-9"></a><a href="#__codelineno-9-9"><span class="linenos" data-linenos=" 9 "></span></a><span class="s">#image-endpoint: unix:///var/run/crio/crio.sock</span>
<a id="__codelineno-9-10" name="__codelineno-9-10"></a><a href="#__codelineno-9-10"><span class="linenos" data-linenos="10 "></span></a><span class="s">timeout: 10</span>
<a id="__codelineno-9-11" name="__codelineno-9-11"></a><a href="#__codelineno-9-11"><span class="linenos" data-linenos="11 "></span></a><span class="s">debug: true</span>
<a id="__codelineno-9-12" name="__codelineno-9-12"></a><a href="#__codelineno-9-12"><span class="linenos" data-linenos="12 "></span></a><span class="s">pull-image-on-create: true</span>
<a id="__codelineno-9-13" name="__codelineno-9-13"></a><a href="#__codelineno-9-13"><span class="linenos" data-linenos="13 "></span></a><span class="s">disable-pull-on-run: false</span>
<a id="__codelineno-9-14" name="__codelineno-9-14"></a><a href="#__codelineno-9-14"><span class="linenos" data-linenos="14 "></span></a><span class="s">EOF</span>
</code></pre></div></p>
</li>
</ul>
<h3 id="43-k3s">4.3 K3s 环境验证<a class="headerlink" href="#43-k3s" title="Permanent link">&para;</a></h3>
<ul>
<li>如果您的容器引擎是 k3s, 则添加 mirrors 地址到<code>/etc/rancher/k3s/registries.yaml</code>, 本质上重启后k3s会自动同步到 <code>/var/lib/rancher/k3s/agent/etc/containerd/config.toml</code>中，它只是内嵌了containerd而已。</li>
</ul>
<div class="highlight"><pre><span></span><code><a id="__codelineno-10-1" name="__codelineno-10-1"></a><a href="#__codelineno-10-1"><span class="linenos" data-linenos=" 1 "></span></a>sudo cp /etc/rancher/k3s/registries.yaml /etc/rancher/k3s/registries.yaml.bak
<a id="__codelineno-10-2" name="__codelineno-10-2"></a><a href="#__codelineno-10-2"><span class="linenos" data-linenos=" 2 "></span></a>sudo cat <span class="s">&lt;&lt;EOF&gt;/etc/rancher/k3s/registries.yaml</span>
<a id="__codelineno-10-3" name="__codelineno-10-3"></a><a href="#__codelineno-10-3"><span class="linenos" data-linenos=" 3 "></span></a><span class="s"># see:https://rancher.com/docs/k3s/latest/en/installation/private-registry/#rewrites</span>
<a id="__codelineno-10-4" name="__codelineno-10-4"></a><a href="#__codelineno-10-4"><span class="linenos" data-linenos=" 4 "></span></a><span class="s">mirrors:</span>
<a id="__codelineno-10-5" name="__codelineno-10-5"></a><a href="#__codelineno-10-5"><span class="linenos" data-linenos=" 5 "></span></a><span class="s">  quay.io:</span>
<a id="__codelineno-10-6" name="__codelineno-10-6"></a><a href="#__codelineno-10-6"><span class="linenos" data-linenos=" 6 "></span></a><span class="s">    endpoint:</span>
<a id="__codelineno-10-7" name="__codelineno-10-7"></a><a href="#__codelineno-10-7"><span class="linenos" data-linenos=" 7 "></span></a><span class="s">      - &quot;https://mirror.registry.your-domain.io&quot;</span>
<a id="__codelineno-10-8" name="__codelineno-10-8"></a><a href="#__codelineno-10-8"><span class="linenos" data-linenos=" 8 "></span></a><span class="s">    #rewrite:</span>
<a id="__codelineno-10-9" name="__codelineno-10-9"></a><a href="#__codelineno-10-9"><span class="linenos" data-linenos=" 9 "></span></a><span class="s">    #  &quot;^argoproj/(.*)&quot;: &quot;public/argoproj/$1&quot;</span>
<a id="__codelineno-10-10" name="__codelineno-10-10"></a><a href="#__codelineno-10-10"><span class="linenos" data-linenos="10 "></span></a><span class="s">  k8s.gcr.io:</span>
<a id="__codelineno-10-11" name="__codelineno-10-11"></a><a href="#__codelineno-10-11"><span class="linenos" data-linenos="11 "></span></a><span class="s">    endpoint:</span>
<a id="__codelineno-10-12" name="__codelineno-10-12"></a><a href="#__codelineno-10-12"><span class="linenos" data-linenos="12 "></span></a><span class="s">      - &quot;https://mirror.registry.your-domain.io&quot;</span>
<a id="__codelineno-10-13" name="__codelineno-10-13"></a><a href="#__codelineno-10-13"><span class="linenos" data-linenos="13 "></span></a><span class="s">  gcr.io:</span>
<a id="__codelineno-10-14" name="__codelineno-10-14"></a><a href="#__codelineno-10-14"><span class="linenos" data-linenos="14 "></span></a><span class="s">    endpoint:</span>
<a id="__codelineno-10-15" name="__codelineno-10-15"></a><a href="#__codelineno-10-15"><span class="linenos" data-linenos="15 "></span></a><span class="s">      - &quot;https://mirror.registry.your-domain.io&quot;</span>
<a id="__codelineno-10-16" name="__codelineno-10-16"></a><a href="#__codelineno-10-16"><span class="linenos" data-linenos="16 "></span></a><span class="s">  docker.io:</span>
<a id="__codelineno-10-17" name="__codelineno-10-17"></a><a href="#__codelineno-10-17"><span class="linenos" data-linenos="17 "></span></a><span class="s">    endpoint:</span>
<a id="__codelineno-10-18" name="__codelineno-10-18"></a><a href="#__codelineno-10-18"><span class="linenos" data-linenos="18 "></span></a><span class="s">      - &quot;https://mirror.registry.your-domain.io&quot;</span>
<a id="__codelineno-10-19" name="__codelineno-10-19"></a><a href="#__codelineno-10-19"><span class="linenos" data-linenos="19 "></span></a><span class="s">configs:</span>
<a id="__codelineno-10-20" name="__codelineno-10-20"></a><a href="#__codelineno-10-20"><span class="linenos" data-linenos="20 "></span></a><span class="s">  &quot;mirror.registry.your-domain.io&quot;:</span>
<a id="__codelineno-10-21" name="__codelineno-10-21"></a><a href="#__codelineno-10-21"><span class="linenos" data-linenos="21 "></span></a><span class="s">    auth:</span>
<a id="__codelineno-10-22" name="__codelineno-10-22"></a><a href="#__codelineno-10-22"><span class="linenos" data-linenos="22 "></span></a><span class="s">      username: user1</span>
<a id="__codelineno-10-23" name="__codelineno-10-23"></a><a href="#__codelineno-10-23"><span class="linenos" data-linenos="23 "></span></a><span class="s">      password: 123456</span>
<a id="__codelineno-10-24" name="__codelineno-10-24"></a><a href="#__codelineno-10-24"><span class="linenos" data-linenos="24 "></span></a><span class="s">EOF</span>
<a id="__codelineno-10-25" name="__codelineno-10-25"></a><a href="#__codelineno-10-25"><span class="linenos" data-linenos="25 "></span></a>
<a id="__codelineno-10-26" name="__codelineno-10-26"></a><a href="#__codelineno-10-26"><span class="linenos" data-linenos="26 "></span></a>sudo systemctl restart k3s
</code></pre></div>
<h2 id="5-helm">5. 配置 helm 并验证<a class="headerlink" href="#5-helm" title="Permanent link">&para;</a></h2>
<ul>
<li>Refer to: https://github.com/wl4g-k8s/helm-nexus3-push-plugin</li>
<li>
<p>Refer to: https://gitee.com/wl4g-k8s/helm-nexus3-push-plugin</p>
</li>
<li>
<p>Installation helm-nexus-plugin</p>
</li>
</ul>
<div class="highlight"><pre><span></span><code><a id="__codelineno-11-1" name="__codelineno-11-1"></a><a href="#__codelineno-11-1"><span class="linenos" data-linenos="1 "></span></a>helm plugin install --version master https://github.com/wl4g-k8s/helm-nexus-push.git
<a id="__codelineno-11-2" name="__codelineno-11-2"></a><a href="#__codelineno-11-2"><span class="linenos" data-linenos="2 "></span></a>helm nexus-push --help
</code></pre></div>
<ul>
<li>Initial helm repo</li>
</ul>
<div class="highlight"><pre><span></span><code><a id="__codelineno-12-1" name="__codelineno-12-1"></a><a href="#__codelineno-12-1"><span class="linenos" data-linenos="1 "></span></a>helm repo add --username myuser --password <span class="m">123456</span> myrepo https://registry.your-domain.io/repository/helm-release/
</code></pre></div>
<ul>
<li>Push chart to nexus3</li>
</ul>
<div class="highlight"><pre><span></span><code><a id="__codelineno-13-1" name="__codelineno-13-1"></a><a href="#__codelineno-13-1"><span class="linenos" data-linenos=" 1 "></span></a><span class="c1">#helm nexus-push myrepo ./mychart</span>
<a id="__codelineno-13-2" name="__codelineno-13-2"></a><a href="#__codelineno-13-2"><span class="linenos" data-linenos=" 2 "></span></a>helm nexus-push myrepo mychart-0.0.1.tgz
<a id="__codelineno-13-3" name="__codelineno-13-3"></a><a href="#__codelineno-13-3"><span class="linenos" data-linenos=" 3 "></span></a>
<a id="__codelineno-13-4" name="__codelineno-13-4"></a><a href="#__codelineno-13-4"><span class="linenos" data-linenos=" 4 "></span></a>Found early saved autorization authorization. Will use user <span class="o">[</span>myuser<span class="o">]</span> with password <span class="o">[</span><span class="m">123456</span><span class="o">]</span> <span class="k">for</span> chart mychart-0.1.0.tgz
<a id="__codelineno-13-5" name="__codelineno-13-5"></a><a href="#__codelineno-13-5"><span class="linenos" data-linenos=" 5 "></span></a>Pushing mychart-0.1.0.tgz to repo https://registry.your-domain.io/repository/helm-release/...
<a id="__codelineno-13-6" name="__codelineno-13-6"></a><a href="#__codelineno-13-6"><span class="linenos" data-linenos=" 6 "></span></a>  HTTP/1.1 <span class="m">100</span> Continue
<a id="__codelineno-13-7" name="__codelineno-13-7"></a><a href="#__codelineno-13-7"><span class="linenos" data-linenos=" 7 "></span></a>  HTTP/1.1 <span class="m">200</span> OK
<a id="__codelineno-13-8" name="__codelineno-13-8"></a><a href="#__codelineno-13-8"><span class="linenos" data-linenos=" 8 "></span></a>  Server: nginx/1.14.1
<a id="__codelineno-13-9" name="__codelineno-13-9"></a><a href="#__codelineno-13-9"><span class="linenos" data-linenos=" 9 "></span></a>  Date: Thu, <span class="m">25</span> Aug <span class="m">2022</span> <span class="m">08</span>:11:05 GMT
<a id="__codelineno-13-10" name="__codelineno-13-10"></a><a href="#__codelineno-13-10"><span class="linenos" data-linenos="10 "></span></a>  Transfer-Encoding: chunked
<a id="__codelineno-13-11" name="__codelineno-13-11"></a><a href="#__codelineno-13-11"><span class="linenos" data-linenos="11 "></span></a>  Connection: keep-alive
<a id="__codelineno-13-12" name="__codelineno-13-12"></a><a href="#__codelineno-13-12"><span class="linenos" data-linenos="12 "></span></a>  X-Content-Type-Options: nosniff
<a id="__codelineno-13-13" name="__codelineno-13-13"></a><a href="#__codelineno-13-13"><span class="linenos" data-linenos="13 "></span></a>  Content-Security-Policy: sandbox allow-forms allow-modals allow-popups allow-presentation allow-scripts allow-top-navigation
<a id="__codelineno-13-14" name="__codelineno-13-14"></a><a href="#__codelineno-13-14"><span class="linenos" data-linenos="14 "></span></a>  X-XSS-Protection: <span class="m">1</span><span class="p">;</span> <span class="nv">mode</span><span class="o">=</span>block
<a id="__codelineno-13-15" name="__codelineno-13-15"></a><a href="#__codelineno-13-15"><span class="linenos" data-linenos="15 "></span></a>Done
</code></pre></div>
<h2 id="6-kubernetes">6. 基于<code>Kubernetes</code>集群生产部署<a class="headerlink" href="#6-kubernetes" title="Permanent link">&para;</a></h2>
<ul>
<li><a href="https://www.cnblogs.com/ooops/p/12929764.html">参考: 基于 OpenShift 搭建 nexus3 私有仓库（带详细截图）</a></li>
</ul>
<p>TODO</p>
<h2 id="7">7. 参考<a class="headerlink" href="#7" title="Permanent link">&para;</a></h2>
<ul>
<li><a href="https://blogs.wl4g.com/archives/3046">Nexus3 误删 Local authentication realms 导致本地登录失败解决</a></li>
</ul>
<h2 id="8-faq">8. FAQ<a class="headerlink" href="#8-faq" title="Permanent link">&para;</a></h2>
<h3 id="81">8.1 复盘编写本文时所遇到的问题：<a class="headerlink" href="#81" title="Permanent link">&para;</a></h3>
<table>
<thead>
<tr>
<th>Image URI</th>
<th>docker pull</th>
<th>nerdctl pull</th>
<th>crictl pull</th>
</tr>
</thead>
<tbody>
<tr>
<td><a href="https://gcr.io/istio-testing/build-tools">gcr.io/istio-testing/build-tools:latest</a></td>
<td>①失败</td>
<td>②失败</td>
<td>③成功</td>
</tr>
<tr>
<td><a href="https://mirror.registry.your-domain.io/istio-testing/build-tools">mirror.registry.your-domain.io/istio-testing/build-tools:latest</a></td>
<td>④成功</td>
<td>⑤成功</td>
<td>⑥成功</td>
</tr>
</tbody>
</table>
<ul>
<li>
<p>原因分析:</p>
</li>
<li>
<p>造成①的原因是因为 docker 仅支持 docker hub 仓库的 mirrors 配置(但 containerd 支持任意仓库的 mirror)
  参见: https://www.cnblogs.com/ryanyangcs/archive/2020/12/21/14168400.html</p>
</li>
<li>
<p>造成②的原因暂未继续跟进，猜测可能跟①相同</p>
</li>
</ul>
<h3 id="82-docker-push">8.2 docker push 镜像时报错<a class="headerlink" href="#82-docker-push" title="Permanent link">&para;</a></h3>
<ul>
<li>
<p>错误：<code>denied: Deploying to groups is a PRO-licensed feature. See https://links.sonatype.com/product-nexus-repository</code></p>
</li>
<li>
<p>出现这个错误通常是推送错了端口，在以上实验中，<code>cr.registry.your-domain.io</code> 必须让 nginx 代理到 <code>my-docker-release</code> 这个仓库，也就是<code>8082</code>，否则如果转发到 my-docker-group(8083) 或 my-docker-proxy-gcr.io(8084) 端口就会触发此错误，第一眼见这个错就容易误以为 nexus3 社区版不支持 docker release，其实本质上 8083 页可以，只不过是 nexus3 的企业版功能。</p>
</li>
</ul>
<h3 id="83">8.3 如何配置支持多租户?<a class="headerlink" href="#83" title="Permanent link">&para;</a></h3>
<ul>
<li>
<p>从如上案例可知，其中命名空间 <code>mylibrary</code> 目前(3.37)在控制台并不能明确设置，在 push 镜像时会自动创建，只要有权限。</p>
</li>
<li>
<p>它的多租户并不是按路径区分，而是在创建每个 docker(group|proxy|hosted) repository 时会要求指定监听端口，然后再通过网关如nginx绑定子域名转发，最终客户端使用的地址就如同阿里云容器镜像服务分配的地址：<code>https://hjbu3ivg.mirror.aliyuncs.com</code>。</p>
</li>
</ul>
<h3 id="84-docker-nexus-blob-minio">8.4 删除 docker 镜像后 Nexus 的 Blob 存储(如 minio)不释放空间<a class="headerlink" href="#84-docker-nexus-blob-minio" title="Permanent link">&para;</a></h3>
<ul>
<li>
<p><strong><em>原因：</em></strong> 摘自官网文档一段描述: <code>Blobs deleted in a repository are only marked for deletion (i.e., a soft delete). You can use the</code><strong><em>Compact blob store task</em></strong> <code>to permanently delete these soft-deleted blobs and therefore free up the used storage space.</code> see to: <a href="https://help.sonatype.com/repomanager3/nexus-repository-administration/repository-management/configuring-blob-stores?_ga=2.84591961.1343370087.1653825921-1469231697.1652932313#ConfiguringBlobStores-CreatingaNewBlobStore">help.sonatype.com/repomanager3/nexus-repository-administration/repository-management/configuring-blob-stores</a></p>
</li>
<li>
<p><strong><em>注：</em></strong><code>Compact Blob Store Task</code> 任务是异步清除，如果数据量比较大，则可能需要几个小时后再观察 Blob Store 使用空间才会减少。</p>
</li>
</ul>
<h4 id="85-pull-not-found-manifest-unknown">8.5 部署成功后 pull 拉取进行报错 not found: manifest unknown.<a class="headerlink" href="#85-pull-not-found-manifest-unknown" title="Permanent link">&para;</a></h4>
<ul>
<li>
<p><strong><em>前提条件：</em></strong> 已在新建的仓库 docker-release 中上传镜像：<code>public/library/alpine:3.6.5</code></p>
</li>
<li>
<p><strong><em>Case1：</em></strong> 在 nexus3 管理页面上 Repoistory -&gt; Repoistories -&gt; docker-release 仓库显示 URL 为: https://registry.your-domain.io/repository/docker-release/ ，但使用它拉镜像报错，如：<code>docker pull mirror.registry.your-domain.io/repository/docker-release/public/library/alpine:3.6.5</code>
<div class="highlight"><pre><span></span><code><a id="__codelineno-14-1" name="__codelineno-14-1"></a><a href="#__codelineno-14-1"><span class="linenos" data-linenos="1 "></span></a>Error response from daemon: manifest for mirror.registry.your-domain.io/repository/docker-release/public/library/alpine:3.6.5 not found: manifest unknown: manifest unknown
</code></pre></div></p>
</li>
<li>
<p><strong><em>Case2：</em></strong> 拉取成功。
<div class="highlight"><pre><span></span><code><a id="__codelineno-15-1" name="__codelineno-15-1"></a><a href="#__codelineno-15-1"><span class="linenos" data-linenos="1 "></span></a>docker pull mirror.registry.your-domain.io/public/library/alpine:3.6.5
<a id="__codelineno-15-2" name="__codelineno-15-2"></a><a href="#__codelineno-15-2"><span class="linenos" data-linenos="2 "></span></a>Pulling from public/library/alpine
<a id="__codelineno-15-3" name="__codelineno-15-3"></a><a href="#__codelineno-15-3"><span class="linenos" data-linenos="3 "></span></a>5a3ea8efae5d: Pulling fs layer ...
</code></pre></div></p>
</li>
<li>
<p><strong><em>Case3：</em></strong> 返回 manifest json 完全一致。</p>
</li>
</ul>
<p>```bash
export authCred=$(echo -n 'username:password' | base64 -w 0)
curl -v -H "Authorization: Basic ${authCred}" https://registry.your-domain.io/repository/docker-group/v2/_catalog
curl -v -H "Authorization: Basic ${authCred}" https://mirror.registry.your-domain.io/v2/_catalog
````</p>
<ul>
<li><strong><em>总结：</em></strong> 
从 Case3 分析，这两接口请求返回的是完全一样，因为前者是 nexus 通过内部 path 区分不同仓库的URL（可能由于 nexus 最早是从 maven 仓库发展而来， 但后面为了支持多种类型仓库，被设计为默认将任何仓库都统一映射一个路径），但是这对于 image 仓库 pull 时指定的镜像路径是有规则的，即它是通过 path 来区分不同用户的 namespace，这点与 maven 不同它是通过 groupId / artfaceId 坐标来确定的，因此对于不熟悉 nexus 的同学很容易误用映射的 URL 来 pull 镜像，如：<code>docker pull registry.your-domain.io/repository/docker-group/public/library/alpine:3.6.5</code> 而报错 <code>Error response from daemon: error parsing HTTP 404 response body: invalid characte '&lt;' looking for beginning of value: "\n&lt;!DOCTYPE html&gt;...</code></li>
</ul>
<p>这点从 nexus3 管理页新建 docker-group/docker-hosted/docker-proxy 仓库也可看出，会要求配置 Connectors 端口，但新建其他如 maven 仓库时是不需要的。</p>

              
            </article>
          </div>
        </div>
        
      </main>
      
        <footer class="md-footer">
  
  <div class="md-footer-meta md-typeset">
    <div class="md-footer-meta__inner md-grid">
      <div class="md-copyright">
  
  
    Made with
    <a href="https://squidfunk.github.io/mkdocs-material/" target="_blank" rel="noopener">
      Material for MkDocs
    </a>
  
</div>
      
    </div>
  </div>
</footer>
      
    </div>
    <div class="md-dialog" data-md-component="dialog">
      <div class="md-dialog__inner md-typeset"></div>
    </div>
    <script id="__config" type="application/json">{"base": "../../../..", "features": ["search.suggest", "search.highlight", "navigation.tabs", "navigation.expand", "toc.follow", "toc.integrate"], "search": "../../../../assets/javascripts/workers/search.5e67fbfe.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.config.lang": "en", "search.config.pipeline": "trimmer, stopWordFilter", "search.config.separator": "[\\s\\-]+", "search.placeholder": "Search", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version.title": "Select version"}, "version": {"default": "latest", "provider": "mike"}}</script>
    
    
      <script src="../../../../assets/javascripts/bundle.c44cc438.min.js"></script>
      
        <script src="../../../../static/js/util.js"></script>
      
    
  </body>
</html>